CVE Catalog
CVE-2026-5874
CriticalCVSS 9.6Exploitation Probability (EPSS)
Low risk0.25%
17th percentile - higher than 17% of all known CVEs
Summary
Google Chrome prior to version 147.0.7727.55 has a use-after-free vulnerability in the PrivateAI component. A remote attacker who convinces a user to perform specific UI gestures can potentially escape the browser sandbox via a crafted HTML page.
Risk Assessment
An attacker can bypass browser isolation mechanisms and gain access to the operating system, potentially leading to system compromise.
Recommendation
Update Google Chrome to version 147.0.7727.55 or later.
Original NVD description (English source)
Use after free in PrivateAI in Google Chrome prior to 147.0.7727.55 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium)